In order for a monitoring system, as for example for monitoring flames, to qualify as "fail-safe" it is necessary that, if the flame (or other condition) is extinguished or becomes non-existent, or if any component in the system fails in either a conducting or non-conducting (operational or inoperative) condition, the system will shut down, or in the flame context, the system will turn off the supply of fuel to the burner being monitored. Usually, the fuel safety shut-off valve in a burner monitoring system is controlled through a relay, by a spring-loaded solenoid, the coil of which must be energized in order for fuel to be supplied to the burner. De-energization of the coil of the solenoid allows the spring to return and close the valve. Such relays and spring-loaded solenoids are so highly reliable that they are considered "fail-safe" and, accordingly, in order to qualify as fail-safe, the possibility of failure of the spring or the valve sticking are not conventionally taken into account. In some systems in which the possibility of such spring or valve failure is regarded as a remote but significant problem, two or more such valve and spring-loaded controls are arranged in series to each burner to further reduce the possibility of unsafe failure at that point in the system.
The classical way that fail-safeness has been attained in flame monitoring systems in the past has been by interrupting the light reaching the photodetector from the flame by means of an intermittently acting shutter which permits bursts of light to reach the photodetector only at a predetermined rate. In this way, during the "flame-on" condition, the output of the photodetector alternates from off to on at the predetermined or characteristic "fail-safe oscillation" rate. Any failure of the shutter or photodetector terminates the "fail-safe oscillation". Likewise, as long as this characteristic, "fail-safe oscillation" , is preserved and continued by the signal processing components between the photodetector and the control element for the fuel supply valve, and the valve control elements are arranged to maintain the fuel valve open only so long as that characteristic output or fail-safe oscillation continues, the system will be fail-safe.
Although such systems have been used for many years, they have numerous drawbacks. For example, the mechanically operated shutters used to create the "fail-safe oscillation" are subject to failure. In addition, such shutters must be interposed in the line-of-sight between the flame and the photodetector. This is inconvenient and expensive. Also the proximity of the shutter to the flame subjects the shutter to intense heat and imposes severe restrictions on the materials and construction of the moving parts, and their drive elements.
Another drawback of such systems stems from the requirement that the closure of the safety shut-off valve be delayed for a short period (usually three seconds in the U.S.A.) in order to account for the case when momentary drop in flame intensity may cause a short cessation of the fail-safe oscillation which may not be indicative of a true flame-out condition. This three second delay requires the use of large and expensive capacitors in the drive circuit for the relay which controls the safety shut-off valve.
Flame monitoring systems not employing mechanical shutters to generate the fail-safe oscillation have been used. In one such system, the photodetector is arranged to detect flame flicker frequencies of about 20 Hz and to transmit them downstream through narrow-band filters. In this way, the fail-safe oscillations are created by the flame itself and are transmitted downstream (usually with resonant enhancement) through the processing circuitry to the fuel valve control circuit. Although such a system avoids the mechanical problems of the shutter-type systems, it still requires large and expensive capacitors for the fuel valve control circuitry and for the above mentioned three second delay. In addition, flicker frequencies in the 20 Hz range are useful only for monitoring single burners. In multiple burner installations, the flame of an operating burner can transmit 20 Hz signals to the photodetector pick-up of an adjacent non-operating burner. Another drawback of systems employing resonant enhancement is the possibility of spurious excitation of the resonant system during a flame "out" condition.
It has been known that reliable discrimination between flames of separate burners can be achieved by filtering the output of the photodetector to eliminate frequencies below say 200 Hz, and to concentrate the output of the photodetector on the higher flicker frequencies (i.e., 200 Hz to 2 KHz) which are detectable only at the root of or along the approximate centerline of any given flame relatively near to the root. Such flicker frequencies, however, vary rapidly and randomly within the 200 Hz-2 KHz range and are, therefore, unsuitable for transmission downsteam as "fail-safe oscillations" to drive fail-safe control circuitry.
Another problem associated with using higher frequencies for generating the "fail-safe oscillations" is that resonances (or resonant inductances) in the system or in the associated equipment may give a false impression of a flame-on condition, and the amplitude of the signals at the higher flicker frequencies drops off drastically. Likewise, the system must be rendered electrically immune to noise spikes which could be caused by closure or activation of switches or circuits, and the danger thereof increases as amplitude lowers and the frequency of the "fail-safe" oscillation increases.
In some cases, however, an opposite situation exists in which the frequency of the "fail-safe oscillation" train, which emanates directly from the condition being sensed, may be so low as to be unsuitable for driving fail-safe control circuitry, and a requirement for introducing, in a fail-safe way a higher frequency "fail-safe oscillation" train for driving the fail-safe control circuitry.
Accordingly, among the objects of the present invention is the provision of means for employing in the same monitoring system a pluralite of different fail-safe oscillation trains adapted for specific purposes together with fail-safe means for activating succeeding trains from a fail-safe output of a previous train. In the context of flame monitoring, an object is to provide a train of "fail-safe oscillations" directly from the flame, through the processing steps to controls without the use of a mechanical shutter and under conditions in which reliable discrimination between flames in a multiple burner installation, is achieved. A further object is to provide, in a fail-safe way, the conversion of a "fail-safe oscillation" train which varies rapdily and randomly over a wide range of frequencies, into a uniform "fail-safe oscillation" train which is more suitable for transmission downstream for activating control circuitry. Still another object is to provide a fail-safe time delay which avoids the use of large and expensive capacitors in the control circuitry. Further objects include providing such a "fail-safe oscillation" train with noise immunity.